The mem0 1.0.0 server contains a memory deletion API endpoint (DELETE /memories/{memory_id}) that does not enforce authentication or authorization checks. Unauthenticated users can delete arbitrary memory entries, leading to unauthorized data loss and possible service denial. The flaw is a missing authentication weakness (CWE‑306) coupled with an authorization bypass (CWE‑862).

The affected product is the mem0 server on version 1.0.0. No other vendors or product versions are listed in the CNA data. The vulnerability applies to any deployment of this specific version that exposes the API over a network.

Based on the description, it is inferred that the attack vector is remote, over HTTP, requiring only network connectivity to the API. Because the endpoint accepts unauthenticated DELETE requests, exploitation is trivially achievable by any client that can reach the server. The EPSS score of <1% indicates a low exploitation probability in the broader landscape, yet the CVSS score of 6.5 reflects moderate severity due to data loss and potential service disruption. The vulnerability is not listed in the CISA KEV catalog, so there are currently no publicly known exploits reported.